I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.
Thanks in advance.
Regards,
Ajeet
I guess the first place to start is checking for EFS in FTK Imager
"To detect encrypted files
1. Do one of the following
Click File > Detect Encryption.
Click the Detect Encryption button on the Toolbar.
The program scans the evidence and notifies you if encrypted files are located. As illustrated in the
figure above, EFS Encrypted files are indicated by a key icon, , in the Evidence Tree."
Ajeet129 Did you find a solution to your problem? What tool did you use to view it? I have a similar issue when viewing an image in FTK Imager version 4.1.1.1. Also, no EFS encryption was detected.
I have forensic images which i am trying to extract but when I am mounting in FTK imager they are showing Unrecognized file system[HPFS/NTFS] when i am trying to expand. I was told they are bitlocked but FTK imager doesn't show anywhere where i can use bit locker password. If anyone familiar to this and suggest how to open that would be helpful.
Ajeet
Im going to make a couple assumption here and when you say "mount", you are talking about adding a disk image to FTKi. As far as im aware FTKi doesnt support decrypting disk images.
You can verify that it is indeed bitlocker encrypted by checking the header of the volume. Check out this link, https://
You should be able to use the mount feature in FTKi to mount the image and then use windows to unlock the volume and create a decrypted image.